[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: Mailman, hard links and the Openwall



* Gergely Madarasz said:

> > > /var/lib/mailman/lists, sometimes as a different user as the file was
> > > originally created with (mail, www-data and list are the possibilities).
> > The /var/lib/mailman/lists catalog is SGID 'list' but files are owned by
> > root.lists (why?) - I see no reason for Mailman to run as root (!!), it's
> > more reasonable to run it as lists and make the entire tree owned by this
> > user. That's how I changed my setup - Mailman always runs as list and the
> > tree belongs to list.
> 
> Currently mailman runs as gid list, with the uid of the webserver or the
> uid of the mailserver. The files get owned by root if you create the list
> as root. It justs sets the gid.
Exactly, which IMHO is also a nuisance. The newlist script should always
make sure to create the list owned by the configured user. Much less
trouble, IMHO.
 
> > Exactly what the original problem was about. I'm using the Solar Desginer's
> > patch and Mailman works provided I make the changes described above. I think
> > they should be the default for each and every package that uses hardlinks
> > for any reason.
> 
> Yeah, if /var/lib/mailman/* is all list user and the wrappers are not just
> setgid wrappers, but setuid wrappers too, then this should work.
It works with no problem.

marek

Attachment: pgponF4dRLA0b.pgp
Description: PGP signature


Reply to: